Quarantine or peer removal

[7aurelius]

Hi,

Is there a way to remove or quarantine multiple search peers (indexers) at the same time? It's not practical enough for me to do it for on every search (one by one) head like the document states. 

[isoutamo]

If you have shell access you can try this https://docs.splunk.com/index.php?title=Documentation:Splunk:DistSearch:Quarantineasearchpeer:6.2.0&...

Just loop over your nodes. 

r. Ismo

[7aurelius]

The indexers are not clustered. They are standalone.

[thambisetty]

removing number of indexers from your indexer cluster depends on your replication & search factor. for example if you have replication factor 2 and you would like to remove two indexers, there is a high chance of having two copies in those indexers. hence you can't remove indexers at same time. you can remove one by one.